# Automatically adding theme scripts to CSP

**URL:** https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028
**Category:** Development
**Tags:** dev-news
**Created:** [April 23, 2020, 5:05pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028 "2020-04-23T17:05:07Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [April 23, 2020, 5:05pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/1 "2020-04-23T17:05:07Z")

</div>

We often see support topics from people trying to add external javascript references to their themes. By default, the content security policy will block this, and the admin has to manually add the script to the CSP site setting (or a theme setting/modifier).

However, @Johani made an excellent suggestion on how we can improve it.

Rather than asking theme developers to copy/paste things around the admin UI, we can do this automatically. We can parse all of the HTML in a theme, extract the src of any external scripts, and add it to the CSP.

After all, computers are a lot better at repetitive copy/paste than humans!

I opened a PR which implements that:

[https://github.com/discourse/discourse/pull/9531](https://github.com/discourse/discourse/pull/9531)

---

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [April 27, 2020, 2:25pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/2 "2020-04-27T14:25:16Z")

</div>

I am seeing some console errors locally:

![image](https://global.discourse-cdn.com/meta/optimized/3X/e/8/e8f875c493782daa0b462a761a6317656856a968_2_690x21.png)

In production environments, I also see sources added in the format `https://CDN_SERVER/theme-javascripts/31657759d037d8c06397e9965a1113169100846e.js...` which is redundant, because the policy already whitelists `https://CDN_SERVER/theme-javascripts`. Probably limit the auto-extension to to external script sources only?

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [April 27, 2020, 2:59pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/4 "2020-04-27T14:59:22Z")

</div>

Thanks @pmusaraj, I added some more checks to make sure we don’t serve invalid urls in the CSP, and also made sure theme-javascript URLs are excluded:

[https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7](https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7)

---

<div class="post-metadata">

### Author: ![fzngagan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fzngagan/32/259349_2.png) [@fzngagan](https://meta.discourse.org/u/fzngagan)
#### Post date: [October 23, 2020, 1:02pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/5 "2020-10-23T13:02:01Z")

</div>

This is awesome. @merefield isn’t this super cool?

---

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [July 17, 2024, 6:58pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/8 "2024-07-17T18:58:56Z")

</div>